From 768aee5fa972ac8a8f6b6b7b4e77e4c14de13360 Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Fri, 7 Aug 2026 12:44:10 +0100 Subject: [PATCH] =?UTF-8?q?fix(ci):=20relock=20dtolnay/rust-toolchain@stab?= =?UTF-8?q?le=20=E2=80=94=20upstream=20ref=20moved?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Every Rust-touching workflow fails at startup with: Lockfile pin 4cda84d5c5c54efe2404f9d843567869ab1699d4 for `dtolnay/rust-toolchain` does not match ref `stable` `stable` is a moving ref: dtolnay re-points it at each Rust release, so a lockfile pin against it goes stale on upstream's schedule rather than ours. Upstream now resolves to 4360b52568e2003a75bf9bc1d59f33a8e3fc893c. Blast radius while stale: Cargo Audit, MVP Smoke, Server Boot Gate, Live Provers, Rust CI, S4 Loop, Chapel CI, Formal Verification — all fail before running a step, on main and on every PR. `gh actions-lock --relock` alone does NOT fix it: a plain --relock leaves pins whose recorded commit is no longer reachable upstream as errors. --accept-moved is required to re-resolve them. Two side-effects of the tool were reverted rather than committed: - it re-inserted its "managed by gh actions-lock" marker at line 1 of all 31 workflows, duplicating the existing marker and displacing the SPDX identifier from line 1, which the Workflow Security Linter requires (it greps head -1). Deduped; SPDX restored to line 1. - it added a lockfile entry for main-estate-audit.yml, an untracked scratch file that is not part of the repository. Removed. Result is a one-line change. This recurs whenever upstream moves `stable`; the durable fix is either pinning a released tag instead of a moving ref, or a scheduled relock. Co-Authored-By: Claude Opus 5 --- .github/workflows/actions.lock | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/actions.lock b/.github/workflows/actions.lock index de1dd8dc..755963a3 100644 --- a/.github/workflows/actions.lock +++ b/.github/workflows/actions.lock @@ -131,7 +131,7 @@ dependencies: - 'actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f' 'dtolnay/rust-toolchain@stable': ref: 'stable' - commit: 'sha1-4cda84d5c5c54efe2404f9d843567869ab1699d4' + commit: 'sha1-4360b52568e2003a75bf9bc1d59f33a8e3fc893c' owner_id: 1940490 repo_id: 260749683 'github/codeql-action@v4.37.3':